95 lines
1.9 KiB
Markdown
95 lines
1.9 KiB
Markdown
# 🔐 Certbot – SSL Certificate Management Guide
|
||
|
||
## 📦 Install Certbot
|
||
|
||
```bash
|
||
apt install certbot
|
||
```
|
||
|
||
Installs **Certbot**, the free tool to automatically obtain and manage SSL/TLS certificates from **Let's Encrypt**.
|
||
|
||
---
|
||
|
||
## 🖥️ Method 1 – Standalone Mode
|
||
|
||
```bash
|
||
certbot certonly --standalone -d www.example.com
|
||
```
|
||
|
||
💡 **Standalone mode** runs its own temporary web server to complete the verification.
|
||
|
||
* Use when no web server (Apache/Nginx) is running on the same port.
|
||
* Certificates will be saved in:
|
||
|
||
* All versions: `/etc/letsencrypt/archive/`
|
||
* Latest version (symlink): `/etc/letsencrypt/live/`
|
||
|
||
---
|
||
|
||
## 🌐 Method 2 – Webroot Mode
|
||
|
||
```bash
|
||
certbot certonly --webroot --webroot-path <path> -d <domain>
|
||
```
|
||
|
||
📌 **Webroot mode** places a verification file in your website's public directory.
|
||
|
||
* `<path>` = your website's document root (e.g., `/var/www/html`)
|
||
* Use when your site is already running and accessible.
|
||
|
||
---
|
||
|
||
## 🛠️ Method 3 – Manual DNS Challenge
|
||
|
||
```bash
|
||
certbot certonly --manual --preferred-challenges dns -d <domain>
|
||
```
|
||
|
||
🔹 **DNS mode** requires you to manually add a TXT record to your domain’s DNS.
|
||
|
||
* Best for **wildcard** certificates (`*.example.com`)
|
||
* Works even without a running web server.
|
||
|
||
---
|
||
|
||
## ♻️ Renew Certificates
|
||
|
||
### Automatic Renewal
|
||
|
||
```bash
|
||
certbot renew
|
||
```
|
||
|
||
* Renews all certificates close to expiration.
|
||
|
||
### Force Renewal
|
||
|
||
```bash
|
||
certbot renew --force-renewal
|
||
```
|
||
|
||
* Renews certificates **immediately**, even if not expiring soon.
|
||
|
||
---
|
||
|
||
## 📅 Tips
|
||
|
||
* Certificates expire every **90 days** — always set up **auto-renew**.
|
||
* Test renewal without changes:
|
||
|
||
```bash
|
||
certbot renew --dry-run
|
||
```
|
||
|
||
* Restart your web server after renewal to apply new certificates:
|
||
|
||
```bash
|
||
systemctl restart nginx
|
||
# or
|
||
systemctl restart apache2
|
||
```
|
||
|
||
---
|
||
|
||
✨ **With Certbot, your HTTPS setup can be fast, free, and automatic!** 🔒🚀
|